Added users role to manage the playbook as root and remove admin privileges from deck

roles/users/defaults/main.yml

@@ -0,0 +1,7 @@
+users__desktop_user: deck
+
+# Groups that grant administrative rights: wheel for sudo and polkit, sys for
+# CUPS administration.
+users__admin_groups:
+  - wheel
+  - sys

roles/users/handlers/main.yml

@@ -0,0 +1,5 @@
+# A reload keeps established sessions, including Ansible's own.
+- name: Reload sshd
+  ansible.builtin.systemd_service:
+    name: sshd
+    state: reloaded

roles/users/tasks/main.yml

@@ -0,0 +1,65 @@
+# Runs as the installer's desktop user until root is reachable with a key,
+# then switches over and strips that user of its admin rights.
+- name: Authorize the SSH key for root
+  become: true
+  ansible.posix.authorized_key:
+    user: root
+    key: "{{ lookup('ansible.builtin.file', install_ssh_keys__ssh_pubkey_path | expanduser) }}"
+
+# Empty passwords make Ansible skip sshpass and fall back to the key.
+- name: Switch the connection to root
+  ansible.builtin.set_fact:
+    ansible_user: root
+    ansible_ssh_pass: ''
+    ansible_become_password: ''
+
+- name: Drop the desktop user connection
+  ansible.builtin.meta: reset_connection
+
+# Arch already allows root logins with a key. Stop here, with sshd and the
+# desktop user untouched, if root can't get in.
+- name: Check root login
+  ansible.builtin.ping:
+
+- name: Deploy the sshd configuration
+  ansible.builtin.template:
+    src: sshd.conf.j2
+    dest: /etc/ssh/sshd_config.d/01-bc250.conf
+    mode: '0644'
+  notify: Reload sshd
+
+- name: Validate the sshd configuration
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -t
+  changed_when: false
+
+- name: Apply the sshd configuration
+  ansible.builtin.meta: flush_handlers
+
+- name: Grant the desktop user the udisks actions Steam needs
+  ansible.builtin.template:
+    src: deck.rules.j2
+    dest: /etc/polkit-1/rules.d/50-bc250-{{ users__desktop_user }}.rules
+    mode: '0644'
+
+- name: Read the group database
+  ansible.builtin.getent:
+    database: group
+
+- name: Remove the desktop user from the admin groups
+  ansible.builtin.user:
+    name: "{{ users__desktop_user }}"
+    groups: >-
+      {{ ansible_facts.getent_group | dict2items
+         | selectattr('value.2', 'search', '(^|,)' ~ users__desktop_user ~ '(,|$)')
+         | map(attribute='key')
+         | difference(users__admin_groups) }}
+    append: false
+
+# '!' with no hash: password logins are impossible, SDDM autologin still works.
+- name: Remove and lock the desktop user password
+  ansible.builtin.user:
+    name: "{{ users__desktop_user }}"
+    password: '!'

roles/users/templates/deck.rules.j2

@@ -0,0 +1,17 @@
+// {{ ansible_managed }}
+
+// org.valve.holo.rules only grants these to wheel. Steam needs them to eject
+// and power off drives from Game Mode, where no polkit agent can prompt.
+polkit.addRule(function(action, subject) {
+    var permission = {
+        "org.freedesktop.udisks2.eject-media": polkit.Result.YES,
+        "org.freedesktop.udisks2.power-off-drive": polkit.Result.YES,
+        "org.freedesktop.udisks2.filesystem-unmount-others": polkit.Result.YES,
+        "org.freedesktop.udisks2.eject-media-other-seat": polkit.Result.YES,
+        "org.freedesktop.udisks2.power-off-drive-other-seat": polkit.Result.YES,
+    };
+
+    if (subject.user == "{{ users__desktop_user }}") {
+        return permission[action.id];
+    }
+});

roles/users/templates/sshd.conf.j2

@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+AllowUsers root